bpf: correctly initialize classification protocol (#290)

Author: mmat11

bpf/generictracer/k_tracer_defs.h

@@ -36,6 +36,7 @@ make_protocol_args(void *u_buf, int bytes_len, u8 ssl, u8 direction, u16 orig_dp
     args->direction = direction;
     args->orig_dport = orig_dport;
     args->u_buf = (u64)u_buf;
+    args->protocol_type = k_protocol_type_unknown;
 
     return args;
 }

bpf/generictracer/protocol_mysql.h

@@ -267,7 +267,12 @@ static __always_inline u8 is_mysql(connection_info_t *conn_info,
         // +------------+-------------+----------------------+
         // |    3B      |     1B      |     1B     | 4B      |
         // +------------+-------------+----------------------+
-        *packet_type = PACKET_TYPE_REQUEST;
+        if (*protocol_type == k_protocol_type_mysql) {
+            // Already identified, mark this as a request.
+            // NOTE: Trying to classify the connection based on this command
+            // would be unreliable, as the check is too shallow.
+            *packet_type = PACKET_TYPE_REQUEST;
+        }
         break;
     default:
         if (*protocol_type == k_protocol_type_mysql) {